fix: close the tail items from the targeted re-audit

Resolves the 13 rows still partial in docs/rewrite/notes/review-rv4-
codex.md (details in final-Z5.md):
- Escaped config strings are decoded to raw bytes at every OS boundary:
  Flatpak cwd/argv to D-Bus, screen-file paths, the default config
  template, GHOSTTY_RESOURCES_DIR/TERMINFO/shell integration/
  bindtextdomain consumers, custom shader loading, list-themes hyperlinks.
- osbytes escapes literal U+FDD0 on non-Unix too (bijective everywhere);
  the GTK paste dialog only decodes text that was actually encoded.
- shadertoy: whole-array uses of iChannelTime rebuild a plain float[4]
  from the std140-padded members (naga-validated, MSL offsets checked).
- libghostty-vt: the OSC parser holds caller-allocated storage inline
  and command payloads borrow from it, so ghostty_osc_end performs no
  global allocations (verified from Rust and C).
- crash: aarch64 Linux minidump context fixed; macOS fatal signals record
  siginfo, registers and a fault-safe stack walk.
- tripwire: selectionString map allocation-failure cleanup test ported.
- libghostty-vt emits the versioned soname libghostty-vt.so.0 at build
  time (no patchelf needed at install).

Test Plan:
- cargo test --workspace (3342 passed)
- just check-macos; just check-macos x86_64-apple-darwin;
  just check-windows; just check-wasm
- cargo check --target aarch64-unknown-linux-gnu -p ghostty-crash

docs/rewrite/notes/final-Z5.md

@@ -0,0 +1,22 @@
+# Z5 final pass: remaining RV4 "still partial" rows
+
+| RV4 row | Fix | Test |
+|---|---|---|
+| Surface: Flatpak cwd (os/flatpak.rs) | cwd and argv decoded with `config_str_to_bytes` before the D-Bus `ay`; fallback cwd uses `os_bytes(current_dir)` | `flatpak::tests::dbus_bytes_are_decoded` |
+| Surface: screen-file filename (core/surface/binding.rs) | returns `path_to_config_string(canonical)`; paste writes decoded bytes, clipboard gets the decoded text | `screen_temp_file_returns_encoded_non_utf8_path` |
+| Config: default template (config.rs) | `write_config_template` decodes the path for `create_dir_all`/`write`; template rendered as bytes (`{[path]s}` replaced by the raw path bytes) | `config_template_written_at_non_utf8_path` |
+| resourcesdir consumers | `GHOSTTY_RESOURCES_DIR`, `TERMINFO` (`terminfo_dir`), shell-integration paths/env (`resource_path`), `darwin_bundle_env` (XDG_DATA_DIRS/MANPATH, new `append_env_always_os`) and `i18n::init` (bindtextdomain takes a `PathBuf`) all decode the encoded resources dir | existing termio/shell_integration tests + compile on all targets |
+| config/path: custom shader load (shadertoy.rs) | `config_str_to_path` (ghostty-os is now a regular renderer dependency) | covered by load tests |
+| cli/list_themes preview link | `to_uri` percent-encodes the decoded original bytes | `uri_escaping_percent_encodes_original_bytes` |
+| cli/args + osbytes (non-Unix) | `os_to_config_string` on non-Unix goes through shared `valid_str_to_config_string` (escapes literal U+FDD0); cfg-independent | `valid_str_encoder_escapes_literal_escape_char` |
+| gtk surface paste confirmation | `show_clipboard_confirmation(.., encoded)`; only `paste_bytes` (non-UTF-8) is flagged and decoded via `confirmed_paste_bytes`; ordinary text with U+FDD0 U+00FF is pasted verbatim | `confirmed_paste_decodes_only_encoded_text` |
+| shadertoy whole-array uniform copies | naga rejects `float t[4] = iChannelTime;` because the std140 array has stride 16 (type mismatch), so the MSL text patch alone could not help. The prefix member is renamed `iChannelTimeUbo` and `iChannelTime` is a macro for `iChannelTime_plain()`, which rebuilds the plain `float[4]` from the padded elements; element reads and the MSL stride patch keep working (`iChannelTimeUbo_` offsets unchanged) | `whole_array_copy_of_padded_uniform_validates_and_keeps_layout` (naga validation, MSL + GLSL output, MSL offsets vs `Uniforms`) |
+| lib/allocator + terminal/c/osc | `osc::Parser<S: ByteStorage = Vec<u8>>`: the C parser stores `CByteStorage` inline in the caller-allocated `OscParser` (no `Box<dyn>`). `Command<'a>` payloads are `Cow<'a,[u8]>` borrowed from parser storage (Zig slices), per-command parsers no longer copy; `Parser::end` returns `Command<'_>`, the VT stream uses `into_owned()` (same copy count as before). Only the small color request lists (OSC 4/5/10-19/21/104-119) still use the global allocator; they are not exposed through C and dropped before `ghostty_osc_end` returns | Rust: `end_makes_no_global_allocations` (counting `#[global_allocator]` + counting C allocator: 0 global allocs, exactly 1 caller alloc only for the title); C: new section 6 of `alloc_test.c` (allocator frozen after creation, 9 command kinds still parse, title = 1 alloc) |
+| crash (aarch64 compile) | `fpregs` only on x86/x86_64; aarch64 walks the `_aarch64_ctx` extension chain in `__reserved` for the `fpsimd_context` | `minidump::tests::*` (pure `fpsimd_offset`), `cargo check --target aarch64-unknown-linux-gnu -p ghostty-crash --all-targets` |
+| crash (Darwin) | Signal handler records siginfo (signo/code/fault address), full thread state from the `ucontext` (x86_64/arm64 registers) and a frame-pointer stack walk (`mach_vm_read_overwrite`, fault-safe) in the event (`exception.stacktrace.frames/registers`, `mechanism.meta.signal`). A real minidump needs a Mach exception-port handler thread (breakpad design) which cannot be validated without macOS, so it is **not** done | `native::tests::*` (platform independent frame walk + JSON schema); Darwin glue verified with `just check-macos` for both targets |
+| tripwire (selectionString) | `Screen::try_selection_string_map` with `selection_string_tw::check(CopyMap)` and `SelectionStringError`; `selection_string_map` wraps it | `screen_selection_string_map_allocation_failure_cleanup` |
+| libghostty-vt soname | `build.rs` emits `-soname,libghostty-vt.so.<major>` (macOS install_name `@rpath/libghostty-vt.<major>.dylib`); `VT_VERSION` in build.rs is the single source, `install-lib.sh` reads it and only verifies the soname (no patchelf). The vt-capi C test harness installs `libghostty-vt.so.<major>` next to the unversioned name (otherwise the loader would pick a stale system copy) | `tests/soname.rs`, `build.rs` unit test |
+
+Gate: `cargo test --workspace` (3342 passed, 0 failed), `cargo clippy --workspace --all-targets -- -D warnings`, `cargo +nightly fmt --all`, `just check-macos`, `just check-macos x86_64-apple-darwin`, `just check-windows`, `just check-wasm`, aarch64-linux `ghostty-crash` check: all clean.
+
+Remaining caveats: the "open" screen-file action passes the encoded path as the URL string; flatpak env (`a{ss}`) stays UTF-8 only by D-Bus type; the minidump writer occasionally reports `ThreadList` failures in the sandbox and falls back to the event-only envelope (pre-existing).